Describes the policies of Courmacs Legal Ltd (“we,” “us,” or “our”), 1 Cathedral Square, Blackburn, England, BB1 1FB, United Kingdom of Great Britain and Northern Ireland, Email: info@courmacslegal.co.uk | Phone: 0330 341 0481
Courmacs Legal Ltd is authorised and regulated by the Solicitors Regulation Authority (SRA Reg No: 819044) and registered with the Information Commissioner’s Office (ICO Reg No: ZA886741).
Registered in England and Wales under Company Number: 13185687.
By accessing or using our website (courmacslegal.co.uk) (“the Service”), you are consenting to the collection, use, and disclosure of your information in accordance with this Privacy Policy.
If you do not consent, please do not access or use the Service.
We may modify this Privacy Policy at any time without prior notice. The revised version will be effective immediately upon posting. Continued use of the Service after such posting will constitute your acceptance of the updated Privacy Policy. Please review this page periodically.
1. Information we collect
When you complete a form on our website, contact us by email or telephone, interact with us on social media, or engage with us through one of our trading styles, we may collect and process personal information, including:
- Name
- Email address
- Telephone number
- Company name (where relevant, for example, business energy claims)
- Vehicle and finance agreement details
- Information you provide in messages, forms, or calls
2. Information from third parties or public sources
We may receive information about you from reputable third-party sources, including credit reference agencies, the DVLA, regulators, or publicly available sources, where lawful to do so.
3. Credit reference agency and identity checks
We work in partnership with Valid8 IP Ltd, who assist us with identity verification and identifying potential claims through secure data processing.
We will disclose personal data to our partner Valid8 IP Ltd for the provision of credit report and identity information, which may include Equifax Ltd, Experian Ltd, and TransUnion.
These are soft credit searches and do not affect your credit score. They are used solely to verify information and identify potential car-finance agreements.
To understand how credit reference agencies use and share personal data (including the legitimate interests they pursue), please refer to the Credit Reference Agency Information Notices (CRAIN):
- TransUnion – http://www.transunion.co.uk/crain
- Equifax – https://www.equifax.co.uk/crain/
- Experian – https://www.experian.co.uk/legal/crain/
You can review Valid8 IP Ltd’s Privacy Policy for further information on how they handle your data.
4. Consent for identity verification and soft credit searches
Where required, we will ask you to confirm the following consent before carrying out identity verification or soft credit searches:
“I agree to the privacy policy of Courmacs Legal and authorise them to conduct soft credit searches on my behalf through their provider, Valid8 IP Ltd, with no impact on my credit score. I also agree to Valid8 IP’s privacy policy.”
This consent may be obtained online or offline and can be withdrawn at any time.
5. Third-party marketing providers
We may receive personal data from third parties, including marketing introducers, lead generators, comparison websites, advertising partners, and other organisations that carry out their own marketing activity.
These third parties may collect your personal data directly from you through their own websites, forms, adverts, campaigns, call centres, social media activity, or other marketing channels before sharing relevant enquiry or lead information with us.
The personal data we receive may include contact details, identity information, financial or vehicle information, claim or enquiry details, usage data, marketing preferences, and any other information supplied by the third party where it is lawful and necessary for us to assess and respond to the enquiry.
Where a third party shares your personal data with us, we will use it to assess eligibility for our services, carry out necessary checks, contact you about your enquiry or case, and comply with our legal, regulatory, and professional obligations. We expect third parties carrying out their own marketing to provide appropriate privacy information and obtain any consent required for their marketing activity before sharing personal data with us.
In addition to third-party marketing providers, we may generate enquiries and leads through our own in-house marketing activity, including our website, online forms, direct communications, social media, advertising campaigns, events, referrals, and other lawful promotional activity.
Where we collect information through in-house lead generation, we will use it to respond to enquiries, assess eligibility for our services, provide relevant information, carry out necessary checks, maintain records, and contact individuals about the progress or closure of their enquiry or case.
We will only process personal data obtained through in-house lead generation where we have a lawful basis to do so, including consent, legitimate interests, contractual necessity, or legal obligation, as applicable. Individuals can opt out of marketing communications at any time.
6. Public Relations Agency
We may work with Haldaine as a public relations and communications agency to support our external communications, media engagement, reputation management, stakeholder communications, and related public relations activity.
Where necessary for these purposes, we may share limited personal data with Haldaine, such as business contact details, enquiry details, case-related information, media or communications preferences, and information required to manage a communication, campaign, response, or public statement. We will only share personal data where there is a lawful basis to do so and where the sharing is necessary and proportionate.
Haldaine is required to handle personal data securely, confidentially, and only for authorised purposes connected with the public relations services provided to us. We remain responsible for ensuring that any personal data shared with Haldaine is processed in accordance with applicable data protection laws.
7. How we use your information
We may use your personal information for the following purposes:
- Assessing eligibility for claims or services
- Providing legal services and managing cases
- Communicating with you
- Marketing and promotional activity (where permitted by law)
- Collecting feedback and improving our services
- Administration and record-keeping
- Analytics and service improvement
- Security and fraud prevention
- Legal and regulatory compliance
If the way we use your personal information changes, we will update this Privacy Policy and notify you were required.
8. Use of artificial intelligence
We may use artificial intelligence, automation, or technology-assisted tools to support the delivery, administration, monitoring, and improvement of our services. This may include using such tools to help organise enquiries, summarise information, identify relevant records, assist with client communications, support case administration, improve website functionality, detect fraud or security risks, and enhance operational efficiency.
Where AI or automated tools process personal data, we will only use them where we have a lawful basis to do so and where their use is necessary, proportionate, fair, and transparent. We will apply appropriate technical and organisational safeguards, including access controls, confidentiality obligations, data minimisation, accuracy checks, retention controls, and human oversight where appropriate.
We do not use AI or automated tools to make decisions about you that have legal or similarly significant effects without appropriate safeguards. Where any automated decision-making is used in a way that significantly affects you, we will provide relevant information about the decision, explain your rights, and allow you to request human intervention, express your point of view, and contest the decision where applicable.
We may use trusted third-party technology providers to support AI or automated processing. Where we do so, we will take steps to ensure that the provider handles personal data securely, only on lawful instructions, and in accordance with applicable data protection laws and contractual safeguards.
We will not knowingly enter confidential client information, special category data, or unnecessary personal data into public AI tools unless we have assessed the risks, identified a lawful basis, and put appropriate safeguards in place.
9. Direct marketing and newsletters
In addition to marketing activity carried out by third-party partners, we may contact you directly with information about our legal services, updates, insights, and related content.
Where you provide your email address through our website, including where you choose to keep updated, subscribe, or submit an enquiry, you are opting in to receive communications from us. These communications may include newsletters and website updates.
You can opt out or withdraw your consent at any time by using the unsubscribe link included in our marketing emails or by contacting us at marketing@courmacslegal.co.uk.
10. Lawful basis for processing
We process your personal data under one or more of the following lawful bases:
- Consent
- Contractual necessity
- Legitimate interests
- Legal obligation
- Vital interests (rare circumstances)
You may withdraw consent at any time.
11. How we share your information
We may share your personal data where necessary with the following parties:
- Valid8 IP Ltd, who carry out identity verification and soft credit checks on our behalf
- Credit reference agencies (Equifax Ltd, Experian Ltd, and TransUnion) via Valid8 IP Ltd, as part of the identity verification and soft credit checking process
- Marketing introducers such as The Genius Group Ltd (where applicable)
- Funders or financial partners involved in claim financing
- Professional advisers, auditors, and insurers
- Courts and regulators, including the Solicitors Regulation Authority (SRA) and the Information Commissioner’s Office (ICO)
We do not disclose personal data directly to credit reference agencies. All such checks are carried out via Valid8 IP Ltd in accordance with their compliance requirements.
All third parties are required to safeguard your data and use it only for lawful and authorised purposes.
If our business is sold or merged, your personal data may be transferred to the new owner in accordance with applicable data protection laws. the new owner in accordance with applicable data protection laws.
12. Retention of your information
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and to meet our legal, regulatory, and professional obligations.
Where a client has opted in to receive marketing communications, we retain the minimum necessary contact details for marketing purposes only and only until consent is withdrawn.
Information relating to claims, enquiries, or case files is securely deleted or anonymised once it is no longer required for legal, regulatory, or operational purposes.
In some circumstances, personal data may be retained for between 90 days and up to 6 years, or longer where required for legal, regulatory, or fraud-prevention reasons.
Anonymous or aggregated data that cannot identify an individual may be retained indefinitely.
13. Your rights under UK GDPR
- The right to be informed about how your data is used
- The right of access to the personal data we hold about you
- The right to rectification if any information we hold is inaccurate or incomplete
- The right to erasure (“the right to be forgotten”) in certain circumstances
- The right to restrict processing in certain circumstances
- The right to data portability, where applicable
- The right to object to processing, including for direct marketing
- Rights in relation to automated decision-making and profiling
- The right to withdraw consent at any time, where processing is based on consent
- The right to lodge a complaint with the Information Commissioner’s Office (ICO)
To exercise any of these rights, contact info@courmacslegal.co.uk. If you withdraw consent, we may be unable to provide certain services.
14. Cookies and analytics
Our website uses cookies and similar technologies, including Google Analytics and Hotjar, to help us understand how visitors use our website and to improve our services.
Google Analytics collects information such as pages visited, time spent on our website, and how you arrived at our site. This information is processed by Google in accordance with Google’s own privacy policy and may involve data being transferred outside the UK, subject to appropriate safeguards.
Hotjar (now part of Contentsquare) helps us understand how visitors interact with our website, for example through anonymised heatmaps, scroll tracking, and session recordings. This information is processed in accordance with Hotjar’s own privacy policy, and Contentsquare holds independently audited security certifications including ISO 27001 and SOC 2 Type II.
We also use Google Ads to run and measure our advertising, including conversion tracking and remarketing. This allows us to see when someone has clicked one of our adverts and to show relevant adverts to people who have previously visited our website. We follow Google’s advertising policies when doing so.
You can opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on, opt out of personalised Google Ads via Google’s Ads Settings (adssettings.google.com), and opt out of Hotjar tracking via Hotjar’s own opt-out mechanism, or by managing your cookie preferences through our cookie banner.
Full details of the cookies we use, including Google Analytics, Google Ads and Hotjar, are set out in our Cookie Policy.
15. Security
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure.
16. Third-party links
Our Service may contain links to third-party websites. This Privacy Policy does not apply to those websites. We recommend reviewing their privacy policies separately.
15. Grievance / Data Protection Officer
If you have any queries or concerns about how your information is processed, don’t hesitate to get in touch with our Data Protection Officer:
Darren Smith
Courmacs Legal Ltd
1 Cathedral Square, Blackburn, England, BB1 1FB
Email: ds@courmacslegal.co.uk
